docs: def pkcs_mgf1(mgfSeed, maskLen, h):
      """
      Implements generic MGF1 Mask Generation function as described in
      Appendix B.2.1 of RFC 3447. The hash function is passed by name.
      valid values are 'md2', 'md4', 'md5', 'sha1', 'tls, 'sha256',
      'sha384' and 'sha512'. Returns None on error.
  
      Input:
         mgfSeed: seed from which mask is generated, an octet string
         maskLen: intended length in octets of the mask, at most 2^32 * hLen
                  hLen (see below)
         h      : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
                  'sha256', 'sha384'). hLen denotes the length in octets of
                  the hash function output.
  
      Output:
         an octet string of length maskLen
      """
  
      # steps are those of Appendix B.2.1
      if not h in _hashFuncParams:
          warning("pkcs_mgf1: invalid hash (%s) provided")
          return None
      hLen = _hashFuncParams[h][0]
      hFunc = _hashFuncParams[h][1]
      if maskLen > 2**32 * hLen:                               # 1)
          warning("pkcs_mgf1: maskLen > 2**32 * hLen")         
          return None
      T = ""                                                   # 2)
      maxCounter = math.ceil(float(maskLen) / float(hLen))     # 3)
      counter = 0
      while counter < maxCounter:
          C = pkcs_i2osp(counter, 4)
          T += hFunc(mgfSeed + C)
          counter += 1
      return T[:maskLen]